T09 · Insecure Skill Coding Practices
Error
- Location
scripts/kandinsky.py:141- Finding
Caller-controlled API endpoint enables credential and local-file exfiltration
- Content
View full analysis
- Remediation
View remediation
Security audit
Kandinsky
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its media-generation purpose, but its script can be steered to send the API key and selected local files to a different server, so it should be reviewed before installation.
Install only in an environment where the Kandinsky endpoint is trusted and locked down. Do not allow chat or untrusted content to supply --base, --allow-insecure, --no-censor, or arbitrary local file paths. Use a least-privilege API key, restrict uploads to intended media files, and place outputs in a private directory not writable by other users.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/kandinsky.py:451- Finding
Output path validation can be bypassed through a destination symlink
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Вся работа идёт через один скрипт — `scripts/kandinsky.py`: нужен `python3`,
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README specifies that, when used through an agent, the skill is invoked using the Russian phrase «нарисуй закат в горах». This is a natural-language locale constraint presented without any user choice, alternative language option, or justification that the skill is region-specific.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill performs network access and consumes sensitive environment variables, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability: a platform or reviewer cannot easily verify that the skill is limited to the intended execution and network capabilities, increasing the risk of overbroad access if runtime defaults are permissive.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation guidance is very broad ('use whenever the user wants to create or modify visual content'), which can cause the agent to invoke this networked skill in many ambiguous cases without clear user intent. In context, that matters because the skill can upload user-provided images, audio, or prompts to an external API, so over-triggering increases privacy and data-handling risk.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill document is written in Russian, including headings and operational guidance, with no indication that language selection is optional or that the skill is intentionally restricted to a Russian-speaking context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all user-facing guidance in Russian, and nowhere indicates that the user can choose another language or that the skill is intentionally restricted to Russian-speaking users. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring, CLI descriptions, help text, and runtime messages are written entirely in Russian, which imposes a specific language on users. The file does not offer any language selection, fallback, or opt-in mechanism, so this is a natural-language locale policy concern rather than a code-security issue.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
python # ---- низкоуровневые HTTP-хелперы ------------------------------------- def _request(self, method, path, json_body=None, timeout=None, max_bytes=None): url = self.base + path data = None headers = {"Authorization": f"Bearer {self.api_key}"}